Medium: postgresql8

Issue Overview: An information leak flaw was found in the way the PostgreSQL database server handled certain error messages. An authenticated database user could possibly obtain the results of a query they did not have privileges to execute by observing the constraint violation error messages...

Low: gpgme

Issue Overview: Multiple heap-based buffer overflows in the statushandler function in 1 engine-gpgsm.c and 2 engine-uiserver.c in GPGME before 1.5.1 allow remote attackers to cause a denial of service crash and possibly execute arbitrary code via vectors related to "different line lengths in a...

Low: pigz

Issue Overview: Multiple directory traversal vulnerabilities in pigz 2.3.1 allow remote attackers to write to arbitrary files via a 1 full pathname or 2 .. dot dot in an archive. Affected Packages: pigz Issue Correction: Run yum update pigz or yum update --advisory ALAS-2015-499 to update your...

Important: freetype

Issue Overview: Multiple integer overflow flaws and an integer signedness flaw, leading to heap-based buffer overflows, were found in the way FreeType handled Mac fonts. If a specially crafted font file was loaded by an application linked against FreeType, it could cause the application to crash...

Medium: openssl

Issue Overview: A use-after-free flaw was found in the way OpenSSL importrf certain Elliptic Curve private keys. An attacker could use this flaw to crash OpenSSL, if a specially-crafted certificate was imported. CVE-2015-0209 A denial of service flaw was found in the way OpenSSL handled certain...

D-Link and TRENDnet 'ncc2' service - multiple vulnerabilities

D-Link and TRENDnet 'ncc2' service - multiple vulnerabilities Discovered by: ---- Peter Adkins [email protected] Access: ---- Local network; unauthenticated access. Remote network; unauthenticated access. Remote network; 'drive-by' via CSRF. Tracking and identifiers: ---- CVE - Mitre...

Moodle 2.5.9/2.6.8/2.7.5/2.8.3 - Block Title Handler Cross-Site Scripting

Moodle 2.5.9/2.6.8/2.7.5/2.8.3 Block Title Handler Cross-Site Scripting Vendor: Moodle Pty Ltd Product web page: https://www.moodle.org Affected version: 2.8.3, 2.7.5, 2.6.8 and 2.5.9 Summary: Moodle is a learning platform designed to provide educators, administrators and learners with a single...

724CMS 5.01 / 4.59 / 4.01 / 3.01 Cross Site Scripting

724CMS 5.01 Multiple XSS Cross-site Scripting Security Vulnerabilities Exploit Title: 724CMS Multiple XSS Cross-site Scripting Security Vulnerabilities Vendor: 724CMS Product: 724CMS Vulnerable Versions: 3.01 4.01 4.59 5.01 Tested Version: 5.01 Advisory Publication: March 15, 2015 Latest Update:...

724CMS 5.01 / 4.59 / 4.01 / 3.01 Directory Traversal

724CMS 5.01 Directory Path Traversal Security Vulnerabilities Exploit Title: 724CMS /section.php Module Parameter Directory Traversal Security Vulnerabilities Vendor: 724CMS Product: 724CMS Vulnerable Versions: 3.01 4.01 4.59 5.01 Tested Version: 5.01 Advisory Publication: March 14, 2015 Latest...

Whisper: Bypass pin(4 digit passcode on your android app)

i have found that this activities are exported Package: sh.whisper sh.whisper.WMainActivity sh.whisper.WWhisperBrowserActivity sh.whisper.WRelatedActivity sh.whisper.WDiscoverActivity sh.whisper.WCategoryFeedActivity sh.whisper.WSettingsActivity Parent Activity: sh.whisper.WMainV4Activity...

Medium: clamav

Issue Overview: ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted upack packer file, related to a "heap out of bounds condition." Affected Packages: clamav Issue Correction: Run yum update clamav or yum update --advisory ALAS-2015-486 to update your system. New...

Medium: graphviz

Issue Overview: Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via format string specifiers in unknown vector, which are not properly handled in an error string. Affected Packages: graphviz Issue Correction:...

D-Link DIR636L Remote Command Injection Vulnerability

D-Link DIR636L suffers from a remote command injection vulnerability. SWISSCOM CSIRT SECURITY ADVISORY - http://www.swisscom.com/security CVE ID: CVE-2015-1187 Product: D-Link DIR636L Vendor: D-Link Subject: Remote Command Injection - Incorrect Authentication Effect: Remotely exploitable Author:...

D-Link / TRENDnet ncc2 CSRF / Unauthenticated Access

D-Link and TRENDnet 'ncc2' service - multiple vulnerabilities Discovered by: ---- Peter Adkins Access: ---- Local network; unauthenticated access. Remote network; unauthenticated access. Remote network; 'drive-by' via CSRF. Tracking and identifiers: ---- CVE - Mitre contacted; not yet allocated...

Cisco Ironport AsyncOS Cross Site Scripting

Cisco Ironport AsyncOS Cross Site Scripting Vendor: Cisco Product webpage: http://www.cisco.com Affected versions: Cisco Ironport ESA - AsyncOS 8.0.1-023 Cisco Ironport WSA - AsyncOS 8.5.5-022 Cisco Ironport SMA - AsyncOS 8.4.0-126 Date: 24/02/2015 Credits: Glafkos Charalambous CVE: CVE-2013-6780...

Medium: postgresql93

Issue Overview: A stack-buffer overflow flaw was found in PostgreSQL's pgcrypto module. An authenticated database user could use this flaw to cause PostgreSQL to crash or, potentially, execute arbitrary code with the permissions of the user running PostgreSQL. CVE-2015-0243 A flaw was found in wa...

NetGear WNDR Authentication Bypass / Information Disclosure

NetGear WNDR Authentication Bypass / Information Disclosure Discovered by: ---- Peter Adkins [email protected] Access: ---- Local network; unauthenticated access. Remote network; unauthenticated access. Tracking and identifiers: ---- CVE - Mitre contacted; not yet allocated. Platforms...

NetGear WNDR Authentication Bypass / Information Disclosure Vulnerabilities

A number of NetGear WNDR devices contain an embedded SOAP service that is seemingly for use with the NetGear Genie application. As this SOAP service is implemented by the built-in HTTP / CGI daemon, unauthenticated queries will also be answered over the internet if remote management has been...

Medium: kernel

Issue Overview: The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allows local users to bypass intended file permissions by leveraging a POSIX ACL containing an entry for the group category that is more...

Medium: libyaml

Issue Overview: An assertion failure was found in the way the libyaml library parsed wrapped strings. An attacker able to load specially crafted YAML input into an application using libyaml could cause the application to crash. CVE-2014-9130 Affected Packages: libyaml Issue Correction: Run yum...